Last updated: April 13, 2026
Table of Contents
Sori ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights when you use the Sori Chrome extension and website (sori-translator.com).
When you create an account, we collect:
You can sign up with email/password or via Google OAuth. If you sign in with Google, we receive your email address and basic profile information (name and profile picture) from Google. Your password (if applicable) is handled entirely by Supabase Auth, it is hashed before storage and we never have access to it. You can revoke Sori's access to your Google account at any time by visiting your Google Account permissions.
To enforce daily translation quotas, we track:
We also collect aggregated translation statistics (e.g., language pairs used, request counts) to improve the service. These statistics are not linked to individual users or translation content.
We do not store the text you translate. Translation requests are sent to OpenAI in real-time and are not saved on our servers.
To diagnose and fix issues, we may log errors that occur during your use of the extension. Error logs may include the error type, error message, and contextual information about where the error occurred. They do not include the text you translate.
If you submit a bug report or feedback (e.g., on uninstall), we collect:
These submissions are voluntary and contain only what you choose to write.
Payments are processed by Stripe. We do not store your card number or billing details on our servers. We only receive your subscription tier from Stripe.
The extension stores the following in Chrome's local storage, this data stays on your device and is not sent to us:
We do not use your data for advertising or sell it to third parties.
We use the following third-party services, each with their own privacy policies:
We take reasonable measures to protect your data, including encrypted connections (HTTPS), secure authentication, input sanitization, rate limiting, and access controls. However, no system is 100% secure and we cannot guarantee absolute security.
You have the right to:
To exercise any of these rights, contact us at our help page.
Sori is not intended for users under 13 years of age (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page when we do. Continued use of the extension after changes constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy, please reach out via our help page.
The following annexes provide additional information required by the data protection laws of specific regions. If you are located in one of these regions, the relevant annex applies to you in addition to the main policy above.
This annex applies if you are located in the EU, EEA, Switzerland, or the United Kingdom, where the General Data Protection Regulation (GDPR) or UK GDPR governs the processing of your personal data.
We process your personal data under the following lawful bases:
In addition to the rights listed in Section 7, you also have the right to:
To exercise these rights, please contact us via our help page.
We do not carry out any solely automated decision-making that produces legal effects or similarly significant effects on you, as described in Article 22 of the GDPR.
Your data may be transferred to and processed in countries outside the EU/EEA or UK (for example, by our hosting and API providers). Where this occurs, we rely on adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards to ensure your data receives an equivalent level of protection.
This annex applies if you are a California resident, as defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
As a California resident, you have the right to:
To exercise these rights, please contact us via our help page.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, a different quality of service, or be denied access for exercising your privacy rights.
This annex applies if you are located in Japan, where the Act on the Protection of Personal Information (APPI) governs the handling of your personal data.
We clearly disclose the purposes for which your personal information is used (as described in Section 3 of this policy) and process your data only within those stated purposes.
You have the right to:
To exercise these rights, please contact us via our help page.
Where your personal data is provided to third-party services located outside Japan (as listed in Section 4), those recipients are required to maintain security measures consistent with the APPI.
This annex applies if you are located in the Republic of Korea, where the Personal Information Protection Act (PIPA) governs the processing of your personal data.
Your personal data is collected and processed for specific, explicit, and lawful purposes as described in this policy. We obtain consent or rely on other lawful bases before processing.
Where we entrust data processing to third parties (as listed in Section 4), we maintain written agreements specifying the purpose, scope, and required technical and organizational security measures. We supervise these parties on an ongoing basis.
When your data is transferred outside Korea, we inform you of the purpose, recipient, items transferred, and retention period. Where required, we obtain separate consent. Overseas recipients are required to maintain security measures compliant with PIPA.
You have the right to:
To exercise these rights, please contact us via our help page.
We implement technical and organizational measures to protect your personal data, including access controls, encryption of data in transit, and incident response procedures.
In the event of a personal data breach, we will notify the Personal Information Protection Commission (PIPC) and affected individuals as required by PIPA.